Malicious PDF — malware analysis report

Static analysis result for SHA-256 89e9d4f732ae249f…

MALICIOUS

PDF

39.7 KB Authoring application: pdf-parser
MD5: 0b1861344232926bb2ec22f0f3ccbe66 SHA-1: 39ad92233343f7c2b0ff05fdc3c47cef2d330e20 SHA-256: 89e9d4f732ae249f480d37c86a4b09224e495c59b8f4d1c639eb315153eaede1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://baop.store/uploads/1/3/0/7/130740391/zunadukakezixofel.pdf
    • http://mypccontractor.com/uploads/1/3/0/5/130590297/wusixipipegejoro.pdf
    • http://sookeyhairextensions.com/uploads/1/3/0/6/130604501/490876.pdf
    • http://metalroofexpertwitness.com/uploads/1/3/0/4/130435978/tuvusebumep_ginuvalub.pdf
    • http://mlphotoservice.com/uploads/1/3/0/5/130550953/zifazita-suzejisilut-janulorebadof.pdf
    • http://poeonline.net/uploads/1/3/0/7/130738722/gefabowejaj_koxosi_vugesedukazage.pdf
    • http://radmanusa.com/uploads/1/3/0/6/130621531/miwepivedupelof.pdf
    • http://agilicorp.com/uploads/1/3/0/7/130776326/769716.pdf
    • http://mindfulengagment.com/uploads/1/3/0/6/130603930/6336617.pdf
    • http://thrivetobehealthy.com/uploads/1/3/0/7/130775395/5992cb.pdf
    • http://waxwingaerial.com/uploads/1/3/0/4/130483309/vukazir.pdf
    • http://bellaandpolly.com/uploads/1/3/0/6/130639868/24ace475228373.pdf
    • http://muziekcursusonline.com/uploads/1/3/0/5/130590503/wesufaxarazez.pdf
    • http://art-director.net/uploads/1/3/0/6/130620532/kabovigozumesipixo.pdf
    • http://jahucr.com/uploads/1/3/0/3/130313434/886192.pdf
    • http://affinitytraining.net/uploads/1/3/0/5/130590672/c84247.pdf
    • http://multicarscmc.com/uploads/1/3/0/7/130739341/kiben.pdf
    • http://moralityinthemarketplace.com/uploads/1/3/0/6/130603968/809e9.pdf
    • http://thaipin.com/uploads/1/3/0/5/130588258/8299495.pdf
    • http://edmontonadr.com/uploads/1/3/0/8/130874384/3d8afc8aab1e.pdf
    • http://dealershowing.com/uploads/1/3/0/2/130287940/kegonine_zokurixojo.pdf
    • http://townhousemarketing.com/uploads/1/3/0/4/130476091/b8f4600b17d1.pdf
    • http://moviemedic.net/uploads/1/3/0/6/130621502/95d4f.pdf
    • http://carrollhudders.com/uploads/1/3/0/2/130270953/16222eab.pdf
    • http://bocaijitaishanchuangtianguan.br3h.com/uploads/1/3/0/7/130739693/130739693.html#active+passive+advanced+exercises

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003731.bin
543fca2b6ae18f273fce0c6dedfd106d403fd39386b86a6455c8ee427786d940		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3731 8228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.